SAIC loses data of 4.9 million patients

[KeepItReal]

Source: Slashdot

"Government contractor SAIC just can't seem to get a break. Still fresh off of the Citytime scandal they have now had a data breach where backup tapes of 4.9 Million personnel health records were stolen from an employee's car.

To add insult to injury, evidently the tapes were not encrypted either: 'Tricare did not indicate whether SAIC encrypted the information on the stolen tapes, but Raley said, "It's very hard to encrypt a backup tape."'"

Read more: http://yro.slashdot.org/story/11/10/04/1815256/saic-loses-data-of-49-million-patients

---

So much for HIPAA safeguards for TriCare participants...

Original story link from InformationWeek: Military Health Plan Data Breach Threatens 4.9 Million

http://mobile.informationweek.com/80256/show/3e965baa102213547839cd649524310c/

[valerief]

1. Well, I'm sure they'll get a sternly written letter from the members of Congress bathing in bribes,

ahem, lobbying dollars from them.

[truedelphi]

2. Well that will teach 'em! n/t

[benld74]

3. It is NOT hard to Encrypt a backup tape providing your backup program encrypts,,,,

[Blue_Tires]

4. I'm beginning to wonder how much of this is accidental

There have been probably a dozen incidents the past few years when mountains of unencrypted, sensitive personal data have been stolen because some clown didn't keep an eye on their laptop...

[quakerboy]

5. Not even a laptop

That info should not be on a laptop to begin with, since they have centralized servers at every VA facility I have visited. But this wasn't even a laptop gone missing, as far as I can tell. The article references "backup tapes".

What in blazes were backup tapes doing in an employee's vehicle?

[saras]

6. Probably on their way to or from off-site storage, where they belong.

Backups at your place of business don't protect you in any way against damage to your place of business.

[quakerboy]

8. In an employees personal car?

stopped at an unknown location?

[Yo_Mama]

7. En route to required off-site storage!

Standard security procedures require not just safeguarding the privacy of information, but the information itself. The only way to do that is off-site backup.